Saltar al contenido principal
    Skip to main content

    Digital stamp card for your shop: how it works on the phone and what to watch out for

    A digital stamp card lives in the phone's Wallet, with no app. How it works, how to stop screenshot fraud and what customer data you can ask for.

    By Filip Balik, co-founder · Updated on 17 October 2026

    A digital stamp card is a pass your customer keeps in their phone's Wallet (Apple Wallet on iPhone, Google Wallet on Android). They add it from a link or a QR code, without installing any app of yours. At each purchase you scan their code and the stamp appears on their phone. Before you launch one, get three things right: a screenshot must not work, ask only for the data you need, and don't send promotional emails without permission.

    How a Wallet card works

    Apple and Google both have a pass type designed for exactly this.

    Apple Wallet. Apple calls this type a store card and recommends it for discount, gift and loyalty cards. A pass is a signed package that contains the card's description and its images (Apple, Building a pass). According to Apple, there are four ways to distribute one: from an action inside an app, from an app or App Clip, as a download on a web page, or as an email attachment. For a café, the web and email are enough: the customer doesn't need any app of yours.

    Google Wallet. Google offers loyalty cards built by combining a "class" (the data shared by every card) with an "object" (each customer's own card). They can be issued anywhere that supports links: a website, an email or a text message. If you change the class, the change reaches every customer; if you change an object, it only affects that customer (Google, updating classes and objects).

    Apple Wallet Google Wallet
    Pass type Store card Loyalty card
    How it reaches the customer Download from a website, email attachment or from an app Anywhere with links: web, email or SMS
    How it updates The server sends a push notification and the phone downloads the new version The customer's object is updated; a class change affects everyone
    How it is read at the till Barcodes (QR, PDF417, Aztec, Code128 and others) or NFC Barcode scan, static or rotating, or NFC

    A stamp's journey, step by step

    1. The customer scans a QR code on the counter and saves the card to their Wallet.
    2. At their next purchase they show the card on their phone.
    3. Whoever is serving scans the card's code.
    4. The system checks the code is valid and adds the stamp on the server.
    5. The server updates the pass and the customer's phone shows the new stamp.
    6. Once the card is full, the customer claims their reward.

    Step 5 works differently on each platform. On Apple, the phone registers the pass with the issuer's server using a device identifier and a push token. When something changes, the server sends a push notification and the phone asks for the new version (Apple, Adding a web service to update passes). On Google, you can make a change to the points balance notify the customer, but only up to 3 updates with a notification every 24 hours (Google, push notifications). Don't count on sending a notification for every stamp.

    The tricks, and how to stop them

    With a cardboard card, the trick was an extra stamp. On a phone, the trick is the screenshot: a static code can be photographed and passed to a friend, who collects stamps with it again and again.

    Google tackles this with rotating barcodes: they look like a normal code but change every so often, usually every minute. Google says this reduces the risk from screenshots. It also warns that if you add a static code as a fallback, you lose most of that security. That fallback only shows in web views or apps that don't support rotating codes, and Google expects all its Wallet clients to support them.

    On Apple you can hide the pass's share button with the sharingProhibited option. But Apple itself warns that this doesn't stop the pass being shared in other ways. Hiding a button is not security.

    What really stops fraud is a server that doesn't trust the code it sees. Three simple rules:

    • The code expires. A code that stops working after a short time is useless in yesterday's screenshot.
    • The code is signed. That way nobody can make one up that the system will accept.
    • Stamping needs an action from the shop. The stamp is added by the person serving when they scan, not by the customer from home.

    In Fidelity, for example, the code on the phone is signed and expires after 90 seconds, so a screenshot doesn't work.

    What data to ask your customers for

    To add stamps you don't need to know your customer's name. On Apple, for instance, each pass is already identified by its type and serial number (Apple, Creating a store card pass). And the General Data Protection Regulation (GDPR) requires personal data to be "adequate, relevant and limited to what is necessary" for its purpose, a principle known as data minimisation (GDPR, art. 5.1.c). If you don't need the email address to add stamps, don't ask for it in order to add stamps.

    A few more pointers:

    • How long you keep it. Data must not be kept for longer than necessary (GDPR, art. 5.1.e). Decide what happens to a card that hasn't been used for a long time.
    • Give the basics up front. Article 11 of the LOPDGDD, Spain's data protection act, lets you give a first layer of basic information (who you are, what you use the data for and how people can exercise their rights) with a link to the rest. It fits on the poster with the QR code or on the page where the card is saved.
    • Minors. A minor's consent only counts on its own "when they are over fourteen"; below that age, you need the consent of their parents or guardians (LOPDGDD, art. 7; quotes from Spanish law here are our translation).
    • Free help. The AEPD, Spain's data protection authority, has Facilita RGPD, a free tool for businesses whose processing is low risk, such as customer data. It generates the information notices, the clauses for the contract with whoever processes data on your behalf, and the record of processing activities. The AEPD itself makes clear that having the documents does not mean you automatically comply with the GDPR.

    If you also want the email address for promotions, that is a different purpose and it needs consent. The LOPDGDD defines consent as an expression of will that is "free, specific, informed and unambiguous", given through a statement or "a clear affirmative action" (art. 6.1). In practice: an unticked box, separate from the card. The GDPR adds that, when assessing whether consent is freely given, account is taken of whether providing a service is made conditional on consent to processing data that isn't necessary for that service (art. 7.4). The safe approach is for the card to work just the same if the customer says no. You also have to be able to show that they consented (art. 7.1), and withdrawing consent has to be as easy as giving it (art. 7.3).

    Promotional emails: what the LSSI says

    The LSSI (Ley 34/2002) is Spain's law on information society services and e-commerce. The general rule is in article 21.1 of the LSSI: it is forbidden to send advertising or promotions "by email or any other equivalent means of electronic communication" that the recipient has not previously requested or expressly authorised.

    There is an exception for existing customers (art. 21.2). It applies if there is a prior contractual relationship, you obtained their details lawfully, and you write to them about your own company's products that are similar to what they bought from you. Even then, you have to offer them a simple, free way to object, both when you collect their details and in every message you send. In an email, that means including an address where they can unsubscribe.

    Situation Can you email them promotions?
    They gave you their email and ticked the promotions box Yes, with an unsubscribe option in every email
    They are a customer, you offered them the chance to object when you collected their email, and you write about similar products The LSSI allows it (art. 21.2), with an unsubscribe option in every email
    They gave you their email for something else and you never offered them the chance to object No: the chance to object has to be offered when the data is collected (art. 21.2)
    They only have the card in their Wallet You don't have their email, so there is nothing to send

    Three more rules from the same law:

    • The customer can withdraw their consent at any time with a simple notice (art. 22.1).
    • The message must be clearly identifiable as commercial, and so must the sender (art. 20.1).
    • If the offer includes discounts, prizes or gifts, the conditions must be easy to find and clearly worded (art. 20.2). Write yours in one sentence: how many stamps, what reward and until when.

    And one from the LOPDGDD: anyone doing direct marketing must first check the advertising opt-out systems, unless the customer has given consent to receive it (art. 23.4). One more reason to ask for consent properly from the start.

    What to ask any provider

    1. Does it work in Apple Wallet and in Google Wallet? They are different platforms, each with its own format and its own rules.
    2. Does the code change or expire? What happens if someone shows a screenshot? If the answer is "nothing", the code is static.
    3. Is there a static fallback code? Google warns that it cancels out most of the security of a rotating code.
    4. Who signs the passes? Apple requires a certificate linked to the pass type identifier, generated in an Apple developer account (Apple, Building a pass).
    5. What data about my customers do you store, and which of it is mandatory? Ask about the technical data too, such as the device identifier and the push token.
    6. Will you sign a data processing agreement? The GDPR requires a contract that sets out the subject matter, duration, purpose and the data processed (art. 28.3).
    7. Do you use other providers to process the data? They need your prior written authorisation, and they have to tell you about any changes (art. 28.2).
    8. Where is the data? The contract must also cover your instructions on transfers to third countries (art. 28.3.a).
    9. What happens to the data if I leave? At your choice, the provider must delete it or return it to you when the service ends (art. 28.3.g).
    10. Can other shops see my customers? The answer has to be a clear no.

    How to launch one in your shop

    1. Set the rule. How many stamps, what reward, one stamp per purchase or per amount spent, and whether it expires. Write it in one sentence.
    2. Decide what data you ask for. To add stamps, none. The email address only if you are going to use it, with a separate box.
    3. Prepare the information text. Who you are, what you use the data for and how people can exercise their rights, with a link to the rest. Facilita RGPD helps you draft it. If your customers are a mix of Spanish and English speakers, as in many bars and shops on the Costa Blanca, have it in both languages.
    4. Put the QR code where people expect it. On the counter, on the table or on the receipt, next to the terms.
    5. Train the team. Scan at every purchase, one stamp per scan, and what to do if the code won't read.
    6. Test it on your customers' phones. Ask the provider to confirm which Wallet it works in today, and save the card, stamp it, fill it and redeem it before you open it to the public.
    7. Review it after a few weeks. How many cards have been saved and how many rewards claimed. Adjust the rule if nobody reaches the reward.

    If you would rather skip the technical side, Fidelity puts the card in your customers' phone browser, with no app and no sign-up (it doesn't save to Apple Wallet or Google Wallet today), and each shop is kept separate from the others.

    Sources

    We check every article against primary sources before publishing it. If you spot a mistake, write to info@quantumnovaagency.com and we will correct it.

    Terms in this article

    Book your free diagnosis.

    Emailinfo@quantumnovaagency.comWhatsApp+34 678 428 710
    LocationTorrevieja (Alicante) · all of Spain

    What happens next

    1. 1We reply within 24 hours.
    2. 2We have a call to look at your case.
    3. 3We send you a proposal with a fixed price.

    By submitting this form you agree to your data being handled under the Privacy Policy.